VAM Investments Group S.p.a.
Recruitment and selection of personnel
Recruitment and selection of personnel
The controller processes applicants' personal data as part of its recruitment and selection activities, with a view to potentially entering into an employment or collaboration relationship. The processing includes collecting and reviewing CVs and unsolicited applications; assessing professional profiles; organising and managing interviews; recording information relevant to the selection; and, where applicable, retaining CVs for future opportunities compatible with the applicant's profile.
Why we process the data and on what legal basis
- Collecting and assessing applications.Legal basis: Performance of a contract (or pre-contractual measures) (Art. 6(1)(b) GDPR); Legitimate interest of the controller (Art. 6(1)(f) GDPR)
- Managing interviews and selection activities.Legal basis: Performance of a contract (or pre-contractual measures) (Art. 6(1)(b) GDPR); Legitimate interest of the controller (Art. 6(1)(f) GDPR)
- Possible retention of CVs for future opportunities.Legal basis: Performance of a contract (or pre-contractual measures) (Art. 6(1)(b) GDPR); Legitimate interest of the controller (Art. 6(1)(f) GDPR)
Purposes 1 and 2 are based on taking pre-contractual steps at the data subject's request. Purpose 3 may be based on the controller's legitimate interest in managing future job opportunities, in compliance with the principles of proportionality and storage limitation.
Categories of data subjects
- Job applicants
Data subjects requiring greater protection: B2C customers and/or users and/or others
Categories of personal data
- Identification data (e.g. first name, surname, date of birth)
- Contact data (e.g. telephone, email)
- Professional data (e.g. work experience, qualifications, CV)
- Education and training data (e.g. academic qualifications, certificates)
- Any special category data provided voluntarily (e.g. membership of protected categories)
Special categories of data
- Data concerning health
Grounds for processing special categories of data
- Obligations in the field of employment and social security law (Art. 9(2)(b) GDPR)
Processors
- Microsoft Ireland Ltd. (Software services)
Transfers to third countries
Some personal data are transferred to countries outside the European Economic Area (EEA). Below you will find, for each transfer, the party involved, the destination country and the safeguard that makes it lawful:
- Microsoft Ireland Ltd. (Software services) — United States (safeguard: EU-US Data Privacy Framework)
Microsoft has obtained certification under the EU-US DPF, which is covered by an adequacy decision of the European Commission.
Retention period
The data are retained for the time needed for the selection process; if the application is unsuccessful, as a rule for 6 months for possible future opportunities, unless you request erasure or object.
Consequences of not providing the data
Providing the data is necessary to assess your application; without them it will not be possible to carry out the selection activities or to consider you for open positions. Once the assessment process has ended, you may object to your data being retained for future job opportunities and request their erasure. For processing based on legitimate interest (collecting and assessing applications, managing interviews and retaining CVs), you have the right to object within the limits of Art. 21 GDPR.